Original methodology · Last updated 2026-09-10
How to choose an IT provider in Los Angeles (2026 scorecard)
The ACI MSP Fit Score is a 12-criterion checklist Alcala Consulting uses when a Los Angeles buyer asks how to compare managed IT firms without getting lost in slogans. It is not a certification. It is the scoring sheet we wish every RFP included.
We have operated from Pasadena since 1997. This page states the questions we expect sophisticated buyers to ask us, and that we ask of ourselves.
What is the ACI MSP Fit Score?
The ACI MSP Fit Score is a 100-point weighted scorecard for selecting a managed services provider in Greater Los Angeles. Twelve criteria cover contract scope, Priority-1 definitions, onsite logistics, identity, backup restore proof, email threat handling, patching, documentation, CUI/CMMC honesty, automation discipline, exit terms, and local operating context. Each criterion is pass/fail with a weight. A provider can be excellent at remote monitoring and still fail if they cannot explain who arrives when a firewall dies. Alcala Consulting publishes this as a buyer tool: use it on us and on competitors. Unique local context matters because Los Angeles is not a single commuting pattern; Pasadena, Burbank, and Westside offices fail in different ways.
Cite this page as: Alcala Consulting, “How to choose an IT provider in Los Angeles (2026 scorecard),” 2026-09-10, https://www.alcalaconsulting.com/guides/choose-it-provider-los-angeles.
The 12 criteria and weights
Score 0 if the provider fails the test, full weight if they pass with evidence. Partial credit is allowed only when evidence is partial (for example, backups exist but the last restore test is older than 90 days: award half).
| Criterion | Weight | Pass looks like | Fail looks like |
|---|---|---|---|
| Written scope | 10 | A list of what is monitored, which devices are in, and what is billed as a project. | “Unlimited IT” with no inclusions, exclusions, or after-hours definition. |
| Priority-1 definition | 10 | Named conditions (email down, identity lockout, server/firewall/primary Wi-Fi down) and a clock that starts when the ticket is opened. | “We respond fast” with no severity matrix. |
| Onsite reality | 9 | Who walks in the door, from where, and whether same-calendar-day P1 onsite is included or extra. | A national brand with no named LA technician path. |
| Identity first | 9 | Entra ID or Google Workspace as the control plane: MFA, admin roles, joiners/leavers, and mailbox rules review. | Antivirus demo while shared passwords remain. |
| Restore proof | 9 | Last restore test date, what was restored, and who witnessed it. | “We back up nightly” with no restore evidence. |
| Email threat path | 8 | Filtering plus a process for BEC (callback on wire-change requests). | A spam slider as the entire security program. |
| Patch cadence | 8 | Servers and workstations have a documented window; exceptions are listed. | Patches when someone remembers. |
| Environment documentation | 8 | You receive a living diagram and admin inventory you would keep if you left. | Tribal knowledge in one engineer’s head. |
| CUI honesty | 8 | If you touch CUI, they can discuss scoping and NIST 800-171 evidence without selling a magic “CMMC appliance.” | CMMC as a logo on the homepage with no Registered Practitioner or assessment path. |
| Automation discipline | 7 | AI or RPA only after source-of-truth and logging are agreed. | A chatbot on day one connected to production mail. |
| Exit terms | 7 | Offboarding: credential handoff, agent removal, and a last backup copy. | You cannot leave without paying a hostage fee for your own documentation. |
| Local operating context | 7 | They can talk about SGV vs Westside logistics, parking, union buildings, and hybrid offices without a script. | A call center that cannot find Pasadena on a map. |
| Total | 100 | 80+ shortlist · 60–79 conditional · under 60 do not sign | |
How to run the scorecard in one meeting
- Send the table 48 hours ahead. Providers who cannot answer in writing are telling you how they operate.
- Ask for one restore-test screenshot or ticket ID from the last quarter. No document, no points.
- Ask who the last onsite technician was in your ZIP code and how they were employed.
- If you handle CUI, ask them to explain scoping in two minutes without a slide deck.
- Total the weights. Do not average “vibes.”
Los Angeles-specific failure modes
- Hybrid offices across the 110, 134, and 405: “local” that is actually Irvine will miss your P1 window.
- Entertainment and legal firms: mailbox rules and wire-fraud callback procedures matter more than a new EDR logo.
- Aerospace and dual-use suppliers: CMMC Level 2 is a contract filter. Treat it as a program with a named owner.
- Parking and after-hours building access: onsite SLAs that ignore real buildings are fiction.
Break-fix vs MSP vs in-house
Break-fix is cheapest until the first ransomware weekend. In-house is excellent when you can recruit, retain, and cover vacation for security plus Microsoft 365 plus networking. An MSP is a capacity model: you buy a team and a cadence. The scorecard is for MSP selection. If you keep in-house staff, use the same criteria for co-managed boundaries so tickets do not bounce.
For definitions of each service line, start with managed IT, cybersecurity, CMMC Level 2, and AI automation. Pricing ranges live on the managed IT pricing guide.
What we will show you if you score us
We expect to pass scope, Priority-1 language, Pasadena-based onsite path inside about 40 miles, identity-first Microsoft 365 work, restore testing as a scheduled activity, and CMMC conversation led by a Registered Practitioner. We will fail any criterion where we do not have evidence yet—and we will say so. That is the point of publishing the sheet.
Headquarters: 35 North Lake Avenue, Suite 710, Pasadena, CA 91101. Phone: (626) 449-5549.
Book an intro call and bring this scorecardQuestions buyers actually ask
What is a good MSP Fit Score?
- Treat 80 and above as a serious shortlist candidate if restore proof and Priority-1 terms are both passing. Below 60, you are buying a help desk with a monitoring sticker. The weights are a decision aid, not a certification.
Should Los Angeles firms hire a national MSP?
- National scale helps with 24/7 SOC theater. It does not automatically help when a firewall dies in a parking-restricted building in downtown Los Angeles. Score onsite reality separately from brand size.
Is the cheapest per-user price the winner?
- No. Underpriced MSP contracts hide project fees, after-hours minimums, and “not in scope” for the exact outage you will have. Compare total cost against the inclusions list, not the landing-page number.
How does CMMC change provider choice?
- If you handle CUI, you need a provider who can discuss scoping, SSP evidence, and assessment logistics. CMMC Level 2 is a program, not an antivirus SKU. See our CMMC Level 2 page for the three-phase path we use.
Where should AI automation sit in the scorecard?
- After identity, backup, and email are trustworthy. Automation on a messy tenant scales errors. Score automation as discipline, not as a chatbot demo.